# CVE-2026-87993: HashiCorp Consul-template information disclosure in error handling

Source: https://junglewise.ai/threats/cve-2026-87993-hashicorp-consul-template-information-disclosure-in-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87993 · Severity: high · CVSS 7.7 · Published 2026-09-10

Consul-template is a tool that automatically renders Vault secrets into configuration files for applications and infrastructure. A flaw in its error handling causes secret values to leak into error messages and logs instead of being redacted. Attackers with access to logs or systems using Nomad can view these exposed secrets, potentially compromising sensitive credentials and enabling unauthorized access to protected systems.

Technologies: [HashiCorp Consul-Template](https://junglewise.ai/threats/technologies/consul-template). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-87993 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87993 being exploited in the wild.

**How severe is CVE-2026-87993?** High severity, with a CVSS score of 7.7, published 10 September 2026.

**Which products and versions are affected?** HashiCorp Consul-Template 0.27.2 through 0.42.1.

**Is there a fix for CVE-2026-87993?** A patch was published on 2026-09-10: Fixed in consul-template 0.43.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87993 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87993?** Check whether you run HashiCorp Consul-Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure issue in the secret redaction mechanism of consul-template's error handling path. When template expressions fail to render, the library attempts to redact Vault secret values from error messages before logging or returning them to callers; however, the redaction logic fails to handle all Vault secret response shapes, allowing certain secret field values to escape redaction and appear verbatim in error output. The affected versions (0.27.2 through 0.42.1) are vulnerable when using Vault KV v2 secrets; deployments using only KV v1 secrets are unaffected. Error messages can be written to application logs and, when consul-template integrates with Nomad, exposed in task events accessible to users with job-read permissions. The fix is available in consul-template 0.43.0.

## Affected products

- HashiCorp Consul-template 0.27.2 through 0.42.1

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in consul-template 0.43.0

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740](https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740)

## Related threats

- [HashiCorp Consul-template path redirection in writeToFile helper](https://junglewise.ai/threats/cve-2026-14361-hashicorp-consul-template-path-redirection-in-writetofile-helper)
- [HashiCorp consul-template sandbox path bypass in file helper](https://junglewise.ai/threats/cve-2026-5061-hashicorp-consul-template-sandbox-path-bypass-in-file-helper)